404StarLink

3.4 KiB

Raw Blame History

afrog https://github.com/zan8in/afrog

What is afrog

afrog is an excellent performance, fast and stable, PoC customizable vulnerability scanning (hole digging) tool. PoC involves CVE, CNVD, default password, information leakage, fingerprint identification, unauthorized access, arbitrary file reading, command execution, etc. It helps network security practitioners quickly verify and fix vulnerabilities in a timely manner.

Features

Open Source
Fast, stable, low false positives
Detailed html vulnerability report
PoC can be customized and updated stably
Active community exchange group

Example

Basic usage

# Scan a target
afrog -t http://127.0.0.1

# Scan multiple targets
afrog -T urls.txt

# Specify a scan report file
afrog -t http://127.0.0.1 -o result.html

Advanced usage

# Test PoC 
afrog -t http://127.0.0.1 -P ./test/ 
afrog -t http://127.0.0.1 -P ./test/demo.yaml 

# Scan by PoC Keywords 
afrog -t http://127.0.0.1 -s tomcat,springboot,shiro 

# Scan by PoC Vulnerability Severity Level 
afrog -t http://127.0.0.1 -S high,critical 

# Online update afrog-pocs 
afrog -up 

# Disable fingerprint recognition 
afrog -t http://127.0.0.1 -nf

Screenshot

项目相关

最近更新

[v2.3.1] - 2023-05-05

BUG

解决版本检查导致内网无法使用问题

新增

命令 -disable-update-check，-duc 禁用自动更新检查

修改

现在 update-poc 会自动执行，禁用这个功能，请使用 -duc 命令

[v2.3.0] - 2023-05-02

新增

命令 poc-detail/pd，查看 poc 详情
命令 monitor-targets/mt，在扫描中实时监控目标存活

优化

命令 poc-list/pl，查看 poc 列表

[v2.2.3] - 2023-04-22

优化

可自定义 html report 报告生成目录

PoC

新增 22 PoC

[v2.2.2] - 2023-04-05

修复

修复 afrog html 报告 XSS 漏洞

优化

简化 URL 黑名单机制
优化 http/s 检测功能
优化文件上传 (所有) PoC
优化 RCE (所有) PoC

删除

去掉 Fingerprint 指纹识别及命令参数 (替代工具 pyxis)
去掉不常用命令参数